> ## Documentation Index
> Fetch the complete documentation index at: https://exa.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> The Exa API is served at https://api.exa.ai. Authenticate with `Authorization: Bearer $EXA_API_KEY` (or `x-api-key: $EXA_API_KEY`); create keys at https://dashboard.exa.ai/api-keys?utm_source=docs&utm_medium=docs&utm_campaign=markdown_instructions. Every way an agent can get access to Exa is described at https://exa.ai/auth.md.
> Prefer the official SDKs, `exa-py` (`pip install exa-py`) and `exa-js` (`npm install exa-js`); both read `EXA_API_KEY` from the environment.
> Tool-using agents can call Exa without writing code through the hosted MCP server at https://mcp.exa.ai/mcp, or install the Exa agent skill with `npx skills add exa-labs/agent-skills` (skill file: https://exa.ai/docs/skill.md).
> The OpenAPI specs at https://exa.ai/docs/exa-spec.yaml and https://exa.ai/docs/team-management-spec.yaml are the source of truth for request and response schemas.

# HIPAA

> Use HIPAA compliance mode for eligible cached retrieval requests.

> [!NOTE]
>
> HIPAA compliance is available for Enterprise customers after Exa enables it for your team. Contact [sales@exa.ai](mailto:sales@exa.ai) to discuss Enterprise access, BAA requirements, and enablement.

HIPAA mode is controlled per request with a top-level `compliance` field:

```json theme={null}
{
  "compliance": "hipaa"
}
```

When this field is present on an eligible team, Exa handles the request with HIPAA compliance controls. If your team is not enabled, the API returns `403 FEATURE_DISABLED`.

HIPAA mode includes [Zero Data Retention](https://exa.ai/docs/admin/security/zero-data-retention.md) for those requests: Exa does not persist PHI.

## Supported endpoints

The `compliance` field is recognized on:

* [`/search`](https://exa.ai/docs/reference/search)
* [`/contents`](https://exa.ai/docs/reference/get-contents)

Other endpoints reject the field.

## Requirements

HIPAA mode supports cached retrieval only. Compatible requests:

* On `/search`, set `type` to `lite`, or to the [legacy](https://exa.ai/docs/search/quickstart.md#legacy-search-types) `fast` or `instant`
* Request `text` or `highlights` (not `summary`)
* Use cache-only content: omit freshness fields, or set `maxAgeHours: -1` on `/contents`

Incompatible requests return `400 INVALID_REQUEST_BODY`, including:

* `summary` on `/contents`, or `contents.summary` on `/search`
* Freshness settings that require a live fetch, such as `maxAgeHours: 0` or a positive `maxAgeHours`
* Search requests that omit `type`, or use a type other than `lite`, `fast`, or `instant`

## Example

```bash cURL theme={null}
curl -s -X POST "https://api.exa.ai/contents" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $EXA_API_KEY" \
  -d '{
    "urls": ["https://example.com/article"],
    "compliance": "hipaa",
    "highlights": true,
    "maxAgeHours": -1
  }'
```

## Access

To enable HIPAA mode for your team, contact [sales@exa.ai](mailto:sales@exa.ai). See the [Trust Center](https://trust.exa.ai) for Exa security documentation.